AI Coding-Agent Security: Repository Permissions That Work

Short answer

Give coding agents read access only to required repositories and docs, write access only in an isolated branch, and network access only to allowlisted destinations. Keep production secrets, deploys, database writes, infrastructure changes, package publishing, and destructive commands behind separate credentials and explicit approval. Log prompts, calls, approvals, commands, diffs, tests, and external actions.

Permission matrix

Define permissions by resource and action: source, configuration, secrets, shell, network, packages, Git, CI, artifacts, databases, cloud, issues, and deployments. Choose deny, read, bounded write, approval, or automated write. Avoid one broad token spanning systems.

Safe default

Use a disposable workspace, non-production branch, read-only issues, no secrets, restricted environment, sandboxed shell, denied network by default, allowlisted registries and docs, no force push, no protected-branch write, and no deploy credentials.

Injection and dependencies

Files, issues, package metadata, docs, web pages, and command output can contain hostile instructions. Treat them as untrusted data. Pin dependencies where practical, inspect lifecycle scripts, block arbitrary downloads, and approve new packages.

Logs and response

Retain requests, plans, calls, approvals, denials, commands, network destinations, changed files, diffs, tests, versions, and identity. Review unusual credential, network, or protected-file behavior. Preserve a kill switch and token revocation.

Graduate access

Start in observation mode, then isolated writes, selected commands, and later bounded external actions. Promotion requires accepted output and zero unresolved severe events over a defined sample. Production stays a separate controlled path.